Please excuse my typo: > Here is the snip from /etc/pam.d/system-auth: > > auth [success=ok default=1] pam_sss.so use_first_pass > auth [default=done] pam_afs_sessino.so It is spelled correctly in the /etc/pam.d/system-auth file: auth [default=done] pam_afs_session.so > ... > session optional pam_sss.so > session required pam_afs_session.so -- Jonathan